fortnite external unsafe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fortnite external unsafe.exe
Size 1.4MB
Sample261023-rexptasy4n
SHA256 5b6bd57c7db31237a60f14db705381594d5adb254a08a8f50c85aaeb870e07a4
MD5 9ec3a87b7c509cdd8c49707df6f18ffc
SHA1 4c56c83059c8fffd4c2a50d1413f3f9d18b9453b
SHA512 09bb0d001006336b0d00bd8b0328b68d696ba2a10659f964705086a80bc7aba7abe4bb316482b6bf6144cbecd2ed669a243e24ac8f50512285a958fcd9f31e80
SSDEEP 24576:Cfj5bdof5NBOZBuUUSBaYQj0r95saT1AZzRh6R1giW3npT9:C474Z4dAaYKgDfTYh6tQn
TLSH
T12365E007F3E115B9D06266388952E317E6303C552B24DACF33D92A5C1FA3BE06E76789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fortnite external unsafe.exe

File Explorer

fortnite external unsafe.exe

.exe 1.4MB

fortnite external unsafe.exe

IMPHASH 712b8cb8c4d815814f6d58bb0d61dfcd
SHA256 5b6bd57c7db31237a60f14db705381594d5adb254a08a8f50c85aaeb870e07a4
MD5 9ec3a87b7c509cdd8c49707df6f18ffc
SHA1 4c56c83059c8fffd4c2a50d1413f3f9d18b9453b
SHA512 09bb0d001006336b0d00bd8b0328b68d696ba2a10659f964705086a80bc7aba7abe4bb316482b6bf6144cbecd2ed669a243e24ac8f50512285a958fcd9f31e80
SSDEEP 24576:Cfj5bdof5NBOZBuUUSBaYQj0r95saT1AZzRh6R1giW3npT9:C474Z4dAaYKgDfTYh6tQn
TLSH
T12365E007F3E115B9D06266388952E317E6303C552B24DACF33D92A5C1FA3BE06E76789
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

404160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\4444\source\repos\fortnite external unsafe\build\fortnite external unsafe.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

advapi32

RegOpenKeyW RegCloseKey RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegSetKeyValueW

kernel32

GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW Process32FirstW CloseHandle GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency WaitForSingleObject FreeLibrary QueryPerformanceCounter FindFirstFileW VirtualProtect FindNextFileW GetCurrentProcess FindClose DeleteFileW GetWindowsDirectoryW SetProcessWorkingSetSize VirtualFree VirtualAlloc GetCurrentProcessId GetFileSizeEx WriteFile SetFileTime SetFilePointer MoveFileW FlushFileBuffers GetTempPathW SetUnhandledExceptionFilter InitializeSListHead CreateFileW DeviceIoControl SetConsoleTitleA GetSystemTimeAsFileTime SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive GlobalUnlock WakeAllConditionVariable

user32

GetClientRect PostQuitMessage SetWindowLongW MessageBoxW GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode RegisterClassExA ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetCursorPos SetClipboardData GetWindowLongW GetWindowThreadProcessId DefWindowProcW GetWindowRect IsWindowVisible SetWindowPos EqualRect SetActiveWindow ScreenToClient GetSystemMetrics ShowWindow IsWindow GetAsyncKeyState DispatchMessageW ClientToScreen PeekMessageW AttachThreadInput MessageBoxA GetForegroundWindow EnumWindows CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop TranslateMessage mouse_event GetClipboardData SetForegroundWindow IsIconic FindWindowA

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

msvcp140

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?uncaught_exception@std@@YA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ

ntdll

NtLoadDriver RtlAdjustPrivilege NtUnloadDriver RtlInitUnicodeString NtQuerySystemInformation

winhttp

WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpCloseHandle

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp memchr wcsstr memmove __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler __current_exception __current_exception_context strstr _CxxThrowException memset

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment exit _set_app_type _beginthreadex _seh_filter_exe _crt_atexit _cexit _register_onexit_function _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-stdio-l1-1-0

fgetc fwrite fgetpos setvbuf ftell __stdio_common_vsprintf_s ungetc fflush fsetpos __stdio_common_vsscanf fread _fseeki64 _set_fmode _wfopen _get_stream_buffer_pointers __stdio_common_vfprintf fseek fputc __acrt_iob_func __p__commode fclose __stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

sinf atan2f atan2 __setusermatherr sqrt sqrtf tanf floorf expf powf acosf cosf hypot ceilf fmodf asin

api-ms-win-crt-string-l1-1-0

_stricmp strcmp wcscat_s strlen wcscpy_s strncmp strncpy wcslen

api-ms-win-crt-filesystem-l1-1-0

_wremove _lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale